Privacy Policy

Introduction & Scope

Lokality Technologies ("Lokality", "we", "our", or "us") is committed to safeguarding the privacy and digital trust of local retail merchants, individual shop owners, service providers, and visiting consumers who utilize lokality.in (the "Platform" or "Service").

Lokality serves as a digital storefront enabler and local discovery platform. We empower neighborhood retail businesses (such as electronics stores, grocery stores, fashion boutiques, home goods retailers, and local tradespeople) to showcase their shop profiles and product catalogues online so nearby consumers can find them easily.

This Privacy Policy outlines how we collect, use, store, disclose, and protect personal and commercial data in accordance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act");
• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
• The Consumer Protection (E-Commerce) Rules, 2020; and
• Applicable Meta / WhatsApp Business Terms and developer platform policies.

Roles & Definitions

For the purposes of this Privacy Policy:

• "Data Fiduciary": Means Lokality Technologies, which determines the purpose and means of processing personal data on the Platform.
• "Data Principal": Means the individual to whom the personal data relates (including merchant proprietors, business representatives, and consumers).
• "Merchant" / "Seller": A retail business owner, shopkeeper, or service professional who lists their business, products, or services on Lokality.
• "Consumer" / "Shopper": An individual browsing Lokality to discover local storefronts, explore product availability, or initiate enquiries with local sellers.
• "Digital Storefront": The public webpage hosted on Lokality showcasing a Merchant’s shop details, address, opening status, and product catalogue.

Information We Collect

We collect only the minimum information necessary to build, maintain, and showcase digital storefronts and facilitate local connections between shops and customers.

A. Information Collected from Merchants & Business Owners

When you register, list your shop, or request an onboarding concierge session with Lokality, we collect:

• Business Identity: Shop / trade name, business category (e.g. Electronics, Clothing & Sarees, Grocery), and merchant proprietor/manager name.
• Contact Details: WhatsApp mobile number, primary phone number, and optional business email address.
• Physical Location: Shop address, landmark, town/market area (e.g., Alipurduar, Cooch Behar, Jalpaiguri, Siliguri), and geographic locality.
• Catalogue & Media: Product names, brand names, retail prices, promotional discounts, stock availability status, and storefront/product photographs.
• Verification Data: Voluntary business registration details (such as Trade License, Shop & Establishment certificate, or GSTIN where applicable for verified seller status).

B. Information Collected from Consumers & Site Visitors

When consumers browse Lokality:

• Locality Preferences: The selected market or town (e.g., Alipurduar) chosen by the user to view relevant local shops.
• Search & Interaction Metrics: Products viewed, merchant pages opened, and clicks on WhatsApp enquiry buttons.
• Device & Network Data: IP address, browser type, operating system version, referring URL, and session timestamps.

How We Collect Data

Information is gathered through the following transparent channels:

• Direct Submission by Merchants: Through WhatsApp onboarding dialogues, sign-up forms, digital onboarding visits, or merchant catalogue update requests.
• Direct Shopper Actions: When shoppers select their home locality or click on product catalogue items.
• Automated Platform Logs: Standard HTTP request headers and analytics scripts generated during your visit to lokality.in.

Purpose of Processing & Legal Basis

Under the DPDP Act 2023, we process personal data based on your explicit consent, legitimate business purposes, and statutory requirements:

WhatsApp Interactions & Communication Architecture

Lokality is built to streamline commerce by leveraging WhatsApp click-to-chat functionality (via standard wa.me protocol links). It is crucial to understand how this operates:

• The actual chat, voice calls, images, and negotiations take place on the WhatsApp platform, operated by Meta Platforms, Inc.
• Lokality does not read, intercept, transcribe, or store private personal chat messages or payment transactions exchanged directly between buyers and sellers on WhatsApp.
• Your use of WhatsApp is subject to WhatsApp's own Terms of Service and Privacy Policy.

Sharing & Disclosure of Information

We respect your privacy: Lokality does not sell, trade, rent, or lease personal identifiable information to third-party data aggregators or advertising networks.

We disclose information strictly under the following limited conditions:

• Public Storefront Visibility: Information submitted by merchants for the express purpose of public discovery (such as business name, shop location, catalogue photos, and business WhatsApp number) is published openly on lokality.in for search engines and shoppers.
• Essential Infrastructure Providers: Trusted cloud infrastructure vendors (e.g., Google Cloud Platform, Firebase Hosting) that provide servers, database hosting, content delivery networks (CDNs), and SSL encryption under strict data protection agreements.
• Legal & Regulatory Compliance: When required by an official order from a judicial, police, cybercrime, or regulatory authority under applicable Indian statutes, including the Information Technology Act, 2000.
• Business Restructuring: In the event of a merger, acquisition, reorganization, or sale of assets, user data may be transferred to the acquiring entity, subject to this Privacy Policy.

Data Security & Retention

A. Technical & Organizational Safeguards

We implement industry-standard technical safeguards in compliance with Rule 8 of the SPDI Rules and the DPDP Act 2023:

• All data transmitted between your device and lokality.in is protected via HTTPS with 256-bit TLS encryption.
• Cloud hosting environments are protected by enterprise-grade firewalls, isolated access controls, and regular vulnerability monitoring.
• Administrative access to merchant management databases is restricted to authorized personnel with multi-factor authentication (MFA).

B. Data Retention Policy

We retain merchant account data and catalogue records for as long as your shop listing remains active on Lokality. If a merchant unlists their shop, we will archive or permanently delete the storefront and catalogue assets within thirty (30) business days, except where retention is required by Indian tax, commercial, or cyber-incident reporting laws.

Your Privacy Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, Data Principals (both merchants and consumers) enjoy specific statutory rights:

• Right to Access: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Rectification: Merchants have the right to promptly update inaccurate shop listings, prices, or contact numbers.
• Right to Erasure / Deletion: You may request the permanent removal of your shop profile or contact details from our active directories.
• Right to Withdraw Consent: You may revoke consent previously given for promotional messaging or onboarding calls at any time.
• Right to Nominate: In the event of death or incapacity, a merchant proprietor may designate a nominee to exercise data rights.

To exercise any of these rights, please email us at privacy@lokality.in or submit a message to our Grievance Officer.

Cookies & Local Browser Storage

Lokality uses minimal, functional client-side storage technologies:

• Functional Local Storage: To store your preferred locality (e.g. Alipurduar) so you do not need to select your location on every page visit.
• Essential Technical Cookies: Short-lived cookies necessary to balance web traffic and prevent denial-of-service attempts.

We do not utilize invasive cross-site tracking cookies. You may disable cookies or clear local storage through your browser settings; however, your chosen locality preferences may reset upon each reload.

Children's Privacy & Age Limit

Lokality is a business-to-business and general consumer commercial directory intended for individuals who are at least eighteen (18) years of age or the age of majority in their jurisdiction. We do not knowingly solicit or collect personal data from children under 18. If you believe a minor has submitted personal information, please inform us immediately for prompt deletion.

Grievance Redressal Officer & Contact Channels

In compliance with Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and Section 12/13 of the DPDP Act 2023, Lokality has appointed a dedicated Grievance Officer:

Updates & Modifications to this Policy

We may periodically revise this Privacy Policy to reflect enhancements to our digital storefront tools, regulatory modifications under the DPDP Rules, or evolving technological standards.

When updates occur, we will refresh the "Effective Date" at the top of this page. For significant modifications impacting how merchant data is handled, we will provide conspicuous notice via our website banner or through our merchant WhatsApp communication channel.